CVE-2026-23107: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23107 is a NULL pointer dereference vulnerability in the Linux kernel's ARM64 floating-point SIMD (FPSIMD) signal handling subsystem, specifically in the restore_za_context() function. The flaw allows an unprivileged local attacker to crash the system by triggering a kernel NULL pointer dereference when restoring a ZA (Scalable Matrix Extension) signal context. It affects Linux kernel versions 5.19 through 6.19-rc6, with stable series impacted up to 6.1.161, 6.6.121, 6.12.67, and 6.18.7. Published on February 4, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause (CWE-476: NULL Pointer Dereference) lies in restore_za_context() failing to allocate the task's sve_state buffer before setting the TIF_SME flag. This creates an invalid kernel state where TIF_SME is set but sve_state is NULL. In uncommon but legitimate scenarios — such as task restoration via CRIU (Checkpoint/Restore In Userspace) — the ZA signal context may not have been created by the kernel in the context of the same task, meaning sve_state may never have been allocated. When userspace subsequently enters streaming mode without trapping, the kernel later attempts to save register state to the NULL sve_state pointer, causing a level-2 translation fault and kernel oops (Feedly, git.kernel.org).

Successful exploitation results in a kernel NULL pointer dereference, causing a system crash (kernel oops/panic) and denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. The vulnerability affects ARM64 systems with SME (Scalable Matrix Extension) hardware support running affected kernel versions, and exploitation requires only low-privileged local access (Feedly).

1. Identify a vulnerable target: Locate an ARM64 system with SME hardware support running a Linux kernel between versions 5.19 and 6.18.7 (or 6.19-rc1 through rc6).
2. Obtain local unprivileged access: Gain a low-privileged shell on the target system (e.g., via a standard user account).
3. Craft a malicious ZA signal context: Construct a signal context frame containing a ZA context that was not originally created by the kernel for the current task — for example, by using CRIU to restore a task with a pre-crafted ZA context, or by directly invoking sigreturn with a hand-crafted ucontext containing a ZA record.
4. Trigger restore_za_context(): Invoke sigreturn (e.g., via a signal handler) with the crafted context, causing the kernel to call restore_za_context() which sets TIF_SME without allocating sve_state.
5. Enter streaming mode: Allow the task to enter SME streaming mode (e.g., by executing an SME streaming-mode instruction), which proceeds without trapping because TIF_SME is set.
6. Trigger NULL dereference: When the kernel next attempts to save the task's register state (e.g., on context switch or signal delivery), it dereferences the NULL sve_state pointer, causing a kernel oops and system crash (Feedly).

• Logs: Kernel oops messages in /var/log/kern.log or dmesg output containing Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 with ESR = 0x0000000096000046 and EC = 0x25: DABT (current EL).
• Logs: Stack traces referencing ARM64 FPSIMD or SME signal handling functions (e.g., restore_za_context, fpsimd_save_state) in kernel crash logs.
• Process: Unusual use of sigreturn syscall with crafted ucontext structures on ARM64 systems, particularly from processes associated with CRIU or custom signal-handling binaries.
• File System: Presence of CRIU checkpoint/restore files or scripts targeting ARM64 SME-capable processes in unexpected directories.

Apply the available kernel security updates for the affected stable series: upgrade to kernel 6.1.162 or later (for 5.19–6.1.x), 6.6.122 or later (for 6.2–6.6.x), 6.12.68 or later (for 6.7–6.12.x), or 6.18.8 or later (for 6.13+ series). The fix ensures restore_za_context() allocates sve_state before setting TIF_SME, matching the behavior used when handling SME traps. As a workaround, restrict or disable access to task migration tools such as CRIU if they are not operationally required. Vendor patches have been released for SUSE, Oracle Linux, and Ubuntu (Feedly, SUSE Advisory, Ubuntu Advisory).